System and Methods for Defending Against Root

1. A method for securing sensitive material, comprising: operating, by a computer system, a modified kernel of an operating system for screening one or more modified primitive system functions of the modified kernel of the operating system, wherein the one or more modified primitive system functions include identification value (ID); intercepting, by the computer system, at the modified kernel of the operating system, the one or more modified primitive system functions, each called by a process having an associated process identification value (ID); determining by the one or more modified primitive system functions, executed by the computer system, whether the one or more intercepted primitive system functions are directed to sensitive material residing on the computer system; in response to a determination that the intercepted primitive system functions are directed to said sensitive material, comparing the intercepted primitive system functions IDs with a list of allowed process IDs; allowing or denying, by the one or more modified primitive system functions, executed by the computer system, operation of the intercepted one or more modified primitive system functions during runtime to prevent unauthorized access by a root-level user of the computer system to said sensitive material residing on the computer system based on a list of allowed process IDs, and responsive to a determination that the intercepted primitive system function is directed to said sensitive material; and monitoring, by a remote monitoring unit, operation of said sensitive materials residing on the computer system, wherein root level access to said computer system does not provide root level access to said remote monitoring unit.

2. The method of claim 1 , further comprising denying, by the computer system, user access including root level user access to said one or more modified primitive system functions for a period of time based on the status of said sensitive material.

3. The method of claim 1 , further comprising denying, by the computer system, user access including root level user access to said one or more modified primitive system functions when said one or more modified primitive system functions are directed at said sensitive material.

4. The method of claim 3 , further comprising not permitting, by the computer system, said one or more modified primitive system functions to proceed.

5. The method of claim 1 , further comprising producing, by the computer system, an alarm in response to an unauthorized modified primitive system function directed at said sensitive material.

6. The method of claim 5 , further comprising deleting or encrypting, by the computer system, at least a portion of the sensitive material in response to said alarm, or taking other appropriate action such as notifying remote network nodes of the incident.

7. The method of claim 1 , further comprising: providing, by the computer system, a list of allowed processes related to the sensitive material; intercepting, by the computer system, at the modified kernel of the operating system, a modified primitive system function call directed to said sensitive material, said modified primitive system function call corresponding to a process on said computer system; identifying, by the computer system the process corresponding to the intercepted primitive system function call; and for identified processes not included in the allowed process list, not allowing, by the computer system, the intercepted primitive system function call to proceed.

8. The method of claim 7 , wherein the list of allowed processes corresponds to a list of ID values for the allowed processes, and the method further comprising obtaining a process identification value associated with the process.

9. The method of claim 7 , further comprising determining, based on a remote monitoring or previous laboratory experiments or both, which processes are necessary for the operation of the sensitive materials to provide the list of allowed processes.

10. The method of claim 7 , further comprising analyzing, by the computer system, modified primitive system function calls corresponding to processes which are members of the list of allowed processes to determine information about performance of said processes.

11. The method of claim 7 , further comprising rescheduling, by the computer system, modified primitive system function calls corresponding to processes, which are members of the list of allowed processes to improve operation of the sensitive material.

12. The method of claim 1 , wherein modifications to each of the one or more modified system functions comprises associating a set of additional instructions with each of the one or more modified primitive system functions.

13. The method of claim 1 , further comprising: providing an angel process on the computer system and one or more networked computer systems, respectively, each of said angel processes being inaccessible to the user; enabling, by the one or more modified primitive system functions, communication between any of said angel processes, the modified kernel, and sensitive material residing on the computer system and the respective networked computer system; and for each of said angel processes providing a secure communication link with at least one other angel process.

14. The method of claim 13 , further comprising providing a secure communication link between at least one of the angel processes and said remote monitoring unit, wherein root level access to said computer system does not provide root level access to said remote monitoring unit.

15. The method of claim 1 , further comprising: storing authenticating information in said remote monitoring unit, wherein root level access to said computer system does not provide root level access to said remote monitoring unit; providing said authenticating information to an authorized user over secure communication links; and allowing access to said sensitive material in response to receiving said authenticating information from the authorized users.

16. The method of claim 1 , wherein the one or more modified primitive system functions comprising a disk access, a memory access, or any combination thereof.

17. The method of claim 1 , wherein the one or more modified primitive system functions comprising a ptrace, an insmod, a rmmod, an open, or any combination thereof.

18. The method of claim 1 , wherein the operating system is linux.

19. The method of claim 1 , wherein the operating system is windows or a real time operating system (RTOS).

20. A system for securing sensitive material residing on a computer system, comprising: a computer system comprising one or more networked computers; and a separate authentication server in communication with the computer system, each networked computer of the computer system configured to have sensitive material residing thereon, the server configured to permit access to said sensitive material to one or more authorized users, wherein each of the one or more networked computers comprises an operating system having a modified kernel for intercepting at runtime, at the modified kernel of the operating system, one or more modified primitive system functions of the modified kernel of the operating system and allowing or denying, at the modified kernel, operation of the one or more modified primitive system functions, each having an associated process identification value (ID), to prevent at least in part by the modified primitive system functions, unauthorized access by a root-level user of the computer system to said sensitive material based on a list of allowed process IDs, wherein allowing or denying is performed by comparing the intercepted modified primitive system functions IDs with the list of allowed process IDs, and wherein the root level access to said computer system does not provide root level access to a rmote unit.

21. The system of claim 20 , further comprising a plurality of angel processes, wherein a respective angel process of the plurality of angel processes is provided on each of the one or more networked computers of the computer system, respectively, each angel process of said plurality of angel processes being inaccessible to the user; and for each angel process of said plurality of angel processes, a secure communication link with at least one other angel process; wherein the one or more modified primitive system functions communicate with each angel process of the plurality of angel processes and enable communication between each angel process of the plurality of angel processes and portions of sensitive material residing on the networked computer of the computer system on which the respective angel process resides.

22. The system of claim 21 , wherein said remote unit is in secure communication with at least one of the angel processes, wherein root level access to said computer system does not provide root level access to said remote unit.

23. The system of claim 20 , wherein the modified kernel of the operating system permits examination of modified primitive level function requests before the requests are executed and permits blocking the modified primitive level requests from executing.

24. The system of claim 20 , wherein the modified kernel comprising an unmodified operating system and at least one modifying kernel level module.

25. The system of claim 20 , further comprising the remote unit for storing authenticating information and providing said authenticating information over a secure communications link to the authorized users, wherein said authentication allowing or denying, by the one or more modified primitive system functions, operation of the intercepted one or more modified primitive system functions during runtime to prevent unauthorized access by said user of said computer system to said sensitive material based on a list of allowed process IDs, and responsive to a determination that the intercepted primitive system function is directed to said sensitive material; and monitoring, by a remote monitoring unit, operation of said sensitive materials residing on the computer system, wherein root level access to said computer system does not provide root level access to said remote monitoring unit.

26. A non-transitory computer-readable media comprising a set of computer instructions, which responsive to being executed by a computer system, causes the computer system to perform operations comprising: operating a modified kernel of an operating system on the computer system to screen one or more modified primitive system functions of the modified kernel of the operating system, wherein the one or more modified primitive system functions include identification value (ID); intercepting, at the modified kernel of the operating system, the one or more modified primitive system functions, each called by a process having an associated process identification value (ID); determining by the one or more modified primitive system functions whether the intercepted one or more primitive system functions are directed to sensitive material residing on the computer system; in response to a determination that the intercepted modified primitive system functions are directed to said sensitive material, comparing the intercepted primitive system functions ID with a list of allowed process IDs; allowing or denying, by the one or more modified primitive system functions, operation of the intercepted one or more modified primitive system functions during runtime to prevent unauthorized access by said user of said computer system to said sensitive material based on a list of allowed process IDs, and responsive to a determination that the intercepted primitive system function is directed to said sensitive material; and monitoring, by a remote monitoring unit, operation of said sensitive materials residing on the computer system, wherein root level access to said computer system does not provide root level access to said remote monitoring unit.